# Alert based on content of message
**URL:** https://discuss.elastic.co/t/alert-based-on-content-of-message/144368
**Category:** Elasticsearch
**Created:** [August 14, 2018, 4:12pm UTC](https://discuss.elastic.co/t/alert-based-on-content-of-message/144368 "2018-08-14T16:12:03Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Magnus\_Therning](https://discuss.elastic.co/u/Magnus_Therning)
#### Post date: [August 14, 2018, 4:12pm UTC](https://discuss.elastic.co/t/alert-based-on-content-of-message/144368/1 "2018-08-14T16:12:03Z")
I'd like to be alerted as soon as a message containing the string _"ERROR"_ is logged in our production system. The corresponding Kibana search would be `fields.env:production AND message:ERROR`.
Based on what I've found online this should be possible to achieve, but I just can't figure out exactly how in the UI. Any and all help would be much appreciated.
I'm using version 6.2.4 hosted by [cloud.elastic.co](http://cloud.elastic.co).
---
### Author:  [@thiago](https://discuss.elastic.co/u/thiago)
#### Post date: [August 14, 2018, 8:54pm UTC](https://discuss.elastic.co/t/alert-based-on-content-of-message/144368/2 "2018-08-14T20:54:17Z")
Take a look at this [https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/errors\_in\_logs](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/errors_in_logs)
It should be enough to get you started.
---
### Author:  [@Magnus\_Therning](https://discuss.elastic.co/u/Magnus_Therning)
#### Post date: [August 15, 2018, 9:02am UTC](https://discuss.elastic.co/t/alert-based-on-content-of-message/144368/3 "2018-08-15T09:02:35Z")
Thanks, that didn't only get me started, it got me across the finish line 😃
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 12, 2018, 9:02am UTC](https://discuss.elastic.co/t/alert-based-on-content-of-message/144368/4 "2018-09-12T09:02:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.